key_and_key_mac = ctr(encrypter_key, bs, kexp, iv)
key, key_mac = key_and_key_mac[:-bs], key_and_key_mac[-bs:]
if not compare_digest(mac(encrypter_mac, bs, iv + key), key_mac):
- raise ValueError("invalid authentication tag")
+ raise ValueError("Invalid authentication tag")
return key